Description
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
DentonW DevIL
Default version status: unaffected
0 to ≤ 1.8.0affected
pkg:github/DentonW/DevILReferences
- https://github.com/DentonW/DevIL/issues/67 ↗
- https://hackmd.io/@haind-pwn/devil-gif-palette-reuse-heap-overflow ↗
- https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L189-L226 ↗
- https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L314-L324 ↗
- https://www.vulncheck.com/advisories/devil-through-1.8.0-heap-buffer-overflow-via-gif-igetpalette ↗